Customer Beware: UK Supreme Court Clarifies Banks’ Duties in respect of Fraudulent Payments

In the much-anticipated decision of Philipp v Barclays Bank UK PLC [2023] UKSC 25 (the “Decision”), the UK Supreme Court (the “Court”) rejected the contention that Barclays Bank UK Plc (the “Bank”) owed a duty to its customer to refuse to carry out payment instructions where the Bank had reasonable grounds to believe the customer was being defrauded (the “Proposed Duty”). 

The Facts

Mrs Fiona Philipp and her husband, Dr Robin Philipp, were victims of authorised push payment (APP) fraud. As a result, Mrs Philipp instructed Barclays to make two payments totalling £700,000 to bank accounts in the United Arab Emirates (the “Payments”). On both occasions, Mrs Philipp was telephoned by the Bank to confirm that she had made the transfer request and wished to proceed with the payment. Mrs Philipp confirmed she had.

This case centered on whether the Bank owed Mrs Philipp the Proposed Duty (either in contract or at common law) and was therefore potentially liable to repay her loss.

At first instance, the High Court granted summary judgment in favour of the Bank on the basis that the Bank did not, as a matter of law, owe the customer the Proposed Duty. The Court of Appeal held to the contrary that, in principle, a bank does owe such a duty to its customers; and a trial would be needed to decide whether the Proposed Duty arose in Mrs Philipp’s case.

The Decision

On appeal, the Supreme Court overruled the Court of Appeal’s decision, ruling unanimously that:

• The Bank did not owe the Proposed Duty to its customer. In fact, in executing the Payments, the Bank was carrying out its “basic duty” to perform payment instructions promptly: “It is not for the bank to concern itself with the wisdom or risks of its customer’s payment decisions”.
• The Quincecare duty did not apply. Mrs Philipp sought to rely on the established Quincecare duty[1], which requires a bank not to execute a payment instruction from an agent of a customer without making inquiries if it has reasonable grounds for believing the agent is attempting to defraud the customer. The Court rejected Mrs Philipp’s argument that banks had a duty to act in accordance with a customer’s “really intended” instructions. It distinguished the previous Quincecare cases on the basis that Mrs Philipp was not acting as an agent but as a customer and in fact personally “unequivocally authorised and instructed the bank to make [the Payments]”.
• Such duties can only apply by express agreement. Although it rejected any implied duty, the Court acknowledged that a bank could agree to express terms imposing the Proposed Duty or similar duties. In this case, although the Bank’s relevant terms and conditions included a right to withhold from executing payment instructions if it reasonably thought a payment was “connected to fraud or any other criminal activity”, this was a right afforded to the Bank and not a duty. While the Bank was entitled to do so, it was not obligated to act.

What duties do banks owe?

Although the Decision restricted the circumstances in which the Quincecare duty might apply, it also provided helpful clarity in relation to the duties that are imposed on banks and the parameters of those duties. These include:

Key takeaways for corporate customers

Although the Decision involved a claim brought against the Bank by an individual customer, the case also highlights important lessons for corporate banking customers. In particular:

1. There are still some protections against internal misappropriation. While the Decision has been lauded as a victory for PSPs, it is not all doom and gloom for companies. Importantly, the Court confirmed that the Quincecare duty still applies where payment instructions are provided by a misappropriating agent (i.e., a director or employee of a company seeking to transfer funds for their own gain).  
2. Be careful who is authorised to give instructions. The obvious conclusion for companies is to be cautious about who within the company has actual authority to provide payment instructions to banks to minimise the risk of payments to fraudulent transferees. This includes restricting access to online banking systems and the protection of passwords. So long as the individual is authorised by the company then the bank’s primary duty is to comply with their instructions.
3. Impose instruction mandate controls and monitor account activity. – Although the Court acknowledged that the Purported Duty could have been expressly negotiated with the Bank, this is not a realistic prospect for most corporate banking clients. However, companies can protect themselves from APP fraud in other ways, including imposing certain limits on instruction mandates to add an extra layer of protection. Companies should carefully consider daily payments limits and, where paper instructions are provided to their bank for the making of payments, potentially require additional signatories for payments over a certain size. Further, ongoing monitoring and auditing of company bank accounts may pick up unusual behaviour before it becomes a bigger issue (for example, where several fraudulent payments are intended to be made over a number of days, these can be discovered prior to the later payments being made).

[1] As established in Barclays Bank plc v Quincecare Limited [1992] 4 All ER 363.